feat(cli): add manus-agent silent-patches subcommand for silent patch detection

[manus-use]

Summary

Implement the manus-agent silent-patches CLI subcommand — documented in the README but previously completely unimplemented (no tool module, no CLI wiring existed).

What it does

Scans a GitHub repository's commit history for security fixes that were never assigned a CVE. Uses two-stage heuristic scoring:

1. Message keywords — commit message is checked against patterns typical of security fixes (e.g. "fix buffer overflow", "sanitize input")
2. Diff keywords — if enabled, the commit diff is fetched and scanned for security-relevant code patterns (e.g. bounds checks added, auth guards, CSRF tokens)

Each candidate commit is classified into one of 14 bug classes: auth_bypass, buffer_overflow, command_injection, csrf, directory_traversal, information_disclosure, integer_overflow, memory_corruption, null_dereference, privilege_escalation, race_condition, sql_injection, use_after_free, xss.

Usage (matches README documentation)

manus-agent silent-patches torvalds/linux
manus-agent silent-patches torvalds/linux --since 2025-01-01
manus-agent silent-patches torvalds/linux --output json | jq .[].classification
manus-agent silent-patches owner/repo --fast --max-commits 100

Flags

Flag	Default	Description
--since YYYY-MM-DD	90 days ago	Start date for commit scan
--until YYYY-MM-DD	today	End date
--max-commits N	500	Hard limit on commits fetched
--fast	off	Skip diff scoring (message keywords only)
--output {text,json}	text	Output format

Files changed

• src/manus_agent/tools/detect_silent_patches.py — new tool module (~280 lines)
• src/manus_agent/cli.py — added silent-patches to _SUBCOMMANDS, parser, runner, and dispatch
• tests/test_detect_silent_patches.py — 68 fully-mocked tests covering message scoring, diff scoring, classification, GitHub API mocking, CLI text/JSON output, error handling, and edge cases

Test results

• 1226 passed, 0 failures (baseline 1158 + 68 new)
• All tests are fully mocked — no real HTTP calls

Duplicate check

Checked all 50 open PRs (#77–#137) and 30 merged PRs (#39–#102). No open or merged PR implements silent-patches or a silent patch detector. Related but distinct PRs:

• feat(tools): patch status checker — get_patch_status tool + manus-agent patch-status CLI #86 (patch-status) — checks if a known CVE has a patch; does not scan commits
• feat(tools): patch diff summariser — get_patch_diff tool + manus-use patch-diff subcommand #47 (patch-diff, merged) — summarizes a known patch diff; does not detect silent patches
• feat(cli): vendor-response subcommand + README Vulnerability Analysis Workflow #88 (vendor-response) — tracks vendor response to known CVEs; unrelated